[PATCH 2/4] kernel32: Forward SetCachedSigningLevel to kernelbase.
The Windows 10 kernel32.dll binary contains this function. Signed-off-by: Mohamad Al-Jaf <mohamadaljaf(a)gmail.com> --- dlls/kernel32/kernel32.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/dlls/kernel32/kernel32.spec b/dlls/kernel32/kernel32.spec index 9667f82a5da..1e32939035d 100644 --- a/dlls/kernel32/kernel32.spec +++ b/dlls/kernel32/kernel32.spec @@ -1342,6 +1342,7 @@ @ stdcall -import SearchPathA(str str str long ptr ptr) @ stdcall -import SearchPathW(wstr wstr wstr long ptr ptr) @ stdcall SetCPGlobal(long) +@ stdcall SetCachedSigningLevel(ptr long long long) kernelbase.SetCachedSigningLevel @ stdcall SetCalendarInfoA(long long long str) @ stdcall -import SetCalendarInfoW(long long long wstr) # @ stub SetClientTimeZoneInformation -- 2.34.1
E-mail resend: Forgot to reply-all. Interesting, why do you think this? How does one know how to find out if forwarding or importing is more appropriate? Also, what exactly is the difference between the two? On Mon, Nov 29, 2021 at 3:11 AM Nikolay Sivov <nsivov(a)codeweavers.com> wrote:
It's possible it should be using -import for this function.
Normally, a forwarded function gets a special export entry which records the name of the DLL that has the real implementation and the name or ordinal of the target function. That way, when the loader resolves imports, it can resolve them directly to the real implementation instead of to a thunk in the imported DLL, like you'd have otherwise. But on Windows, a number of functions that would otherwise be forwarded to kernelbase from kernel32 instead use these thunks that call the target in kernelbase--presumably because existing programs abuse hotpatching to hook functions that were in kernel32. For these cases, winebuild supports a special option on a forwarded export which causes it to generate this thunk. November 29, 2021 7:08 PM, "Mohamad Al-Jaf" <mohamadaljaf(a)gmail.com (mailto:mohamadaljaf(a)gmail.com?to=%22Mohamad%20Al-Jaf%22%20<mohamadaljaf(a)gmail.com>)> wrote: E-mail resend: Forgot to reply-all. Interesting, why do you think this? How does one know how to find out if forwarding or importing is more appropriate? Also, what exactly is the difference between the two? On Mon, Nov 29, 2021 at 3:11 AM Nikolay Sivov <nsivov(a)codeweavers.com (mailto:nsivov(a)codeweavers.com)> wrote:It's possible it should be using -import for this function. Chip
Hi Chip, Thanks for the detailed explanation, I think I understand the difference between the two now. But how do you determine if a function should be forwarded or imported? Is there a way to find out for certain? So for SetCachedSigningLevel, how can I know if it's better to forward it or import it? On Mon, Nov 29, 2021 at 9:57 PM Chip Davis <cdavis(a)codeweavers.com> wrote:
Normally, a forwarded function gets a special export entry which records the name of the DLL that has the real implementation and the name or ordinal of the target function. That way, when the loader resolves imports, it can resolve them directly to the real implementation instead of to a thunk in the imported DLL, like you'd have otherwise. But on Windows, a number of functions that would otherwise be forwarded to kernelbase from kernel32 instead use these thunks that call the target in kernelbase--presumably because existing programs abuse hotpatching to hook functions that were in kernel32. For these cases, winebuild supports a special option on a forwarded export which causes it to generate this thunk.
November 29, 2021 7:08 PM, "Mohamad Al-Jaf" <mohamadaljaf(a)gmail.com <mohamadaljaf(a)gmail.com?to=%22Mohamad%20Al-Jaf%22%20%3Cmohamadaljaf(a)gmail.com%3E>> wrote:
E-mail resend: Forgot to reply-all. Interesting, why do you think this? How does one know how to find out if forwarding or importing is more appropriate? Also, what exactly is the difference between the two? On Mon, Nov 29, 2021 at 3:11 AM Nikolay Sivov <nsivov(a)codeweavers.com> wrote:
It's possible it should be using -import for this function.
Chip
You can examine GetProcAddress result. E. g. call GetProcAddress for the function in question from kernel32 and kernelbase and see if the result is the same or not.
On 30 Nov 2021, at 07:31, Mohamad Al-Jaf <mohamadaljaf(a)gmail.com> wrote:
Hi Chip,
Thanks for the detailed explanation, I think I understand the difference between the two now. But how do you determine if a function should be forwarded or imported? Is there a way to find out for certain? So for SetCachedSigningLevel, how can I know if it's better to forward it or import it?
On Mon, Nov 29, 2021 at 9:57 PM Chip Davis <cdavis(a)codeweavers.com> wrote: Normally, a forwarded function gets a special export entry which records the name of the DLL that has the real implementation and the name or ordinal of the target function. That way, when the loader resolves imports, it can resolve them directly to the real implementation instead of to a thunk in the imported DLL, like you'd have otherwise. But on Windows, a number of functions that would otherwise be forwarded to kernelbase from kernel32 instead use these thunks that call the target in kernelbase--presumably because existing programs abuse hotpatching to hook functions that were in kernel32. For these cases, winebuild supports a special option on a forwarded export which causes it to generate this thunk.
November 29, 2021 7:08 PM, "Mohamad Al-Jaf" <mohamadaljaf(a)gmail.com> wrote: E-mail resend: Forgot to reply-all. Interesting, why do you think this? How does one know how to find out if forwarding or importing is more appropriate? Also, what exactly is the difference between the two? On Mon, Nov 29, 2021 at 3:11 AM Nikolay Sivov <nsivov(a)codeweavers.com> wrote: It's possible it should be using -import for this function.
Chip
Hi Paul, Thank you for the brief but informative tutorial. Based on my understanding of what Chip said, the function should be imported because the address differs between kernel32 and kernelbase. I have submitted a revised patch. On Tue, Nov 30, 2021 at 3:20 AM Paul Gofman <pgofman(a)codeweavers.com> wrote:
You can examine GetProcAddress result. E. g. call GetProcAddress for the function in question from kernel32 and kernelbase and see if the result is the same or not.
On 30 Nov 2021, at 07:31, Mohamad Al-Jaf <mohamadaljaf(a)gmail.com> wrote:
Hi Chip,
Thanks for the detailed explanation, I think I understand the difference between the two now. But how do you determine if a function should be forwarded or imported? Is there a way to find out for certain? So for SetCachedSigningLevel, how can I know if it's better to forward it or import it?
On Mon, Nov 29, 2021 at 9:57 PM Chip Davis <cdavis(a)codeweavers.com> wrote:
Normally, a forwarded function gets a special export entry which records the name of the DLL that has the real implementation and the name or ordinal of the target function. That way, when the loader resolves imports, it can resolve them directly to the real implementation instead of to a thunk in the imported DLL, like you'd have otherwise. But on Windows, a number of functions that would otherwise be forwarded to kernelbase from kernel32 instead use these thunks that call the target in kernelbase--presumably because existing programs abuse hotpatching to hook functions that were in kernel32. For these cases, winebuild supports a special option on a forwarded export which causes it to generate this thunk.
November 29, 2021 7:08 PM, "Mohamad Al-Jaf" <mohamadaljaf(a)gmail.com <mohamadaljaf(a)gmail.com?to=%22Mohamad%20Al-Jaf%22%20%3Cmohamadaljaf(a)gmail.com%3E>> wrote:
E-mail resend: Forgot to reply-all. Interesting, why do you think this? How does one know how to find out if forwarding or importing is more appropriate? Also, what exactly is the difference between the two? On Mon, Nov 29, 2021 at 3:11 AM Nikolay Sivov <nsivov(a)codeweavers.com> wrote:
It's possible it should be using -import for this function.
Chip
participants (4)
-
Chip Davis -
Mohamad Al-Jaf -
Nikolay Sivov -
Paul Gofman